An Optimized Decision Tree-Based Framework for Explainable IoT Anomaly Detection

Technical Summary: An Optimized Decision Tree-Based Framework for Explainable IoT Anomaly Detection

Problem Statement
The rapid proliferation of Internet of Things (IoT) devices has significantly expanded the cyber threat surface, necessitating robust Intrusion Detection Systems (IDS). However, existing IoT IDS solutions face a critical triad of challenges: they often struggle with high-dimensional and imbalanced data, incur computational costs too high for resource-constrained edge devices, and lack interpretability. The "black box" nature of many high-performing models (such as deep learning ensembles) undermines trust and hinders compliance with emerging AI transparency regulations. Consequently, there is an urgent need for a lightweight, accurate, and transparent detection framework capable of real-time deployment on edge devices.

Methodology
The authors propose a framework centered on an optimized Decision Tree (DT) classifier, integrated with Explainable AI (XAI) techniques to ensure transparency. The methodology follows a structured pipeline:

1. Data Collection & Preprocessing: The study utilizes the WUSTL-EHMS-2020 dataset, comprising 16,318 normal samples, 1,124 spoofing samples, and 922 data alteration samples. Preprocessing involves removing duplicates, label encoding for categorical variables, and handling outliers via the Interquartile Range (IQR) technique (replacing outliers with means). Features are normalized using z-score normalization to ensure training stability.
2. Feature Selection: To reduce dimensionality and enhance generalization, the authors employ a two-step selection process:
   • Chi-Square Test: Features with p-values > 0.05 are discarded to remove irrelevant variables.
   • Recursive Feature Elimination (RFE) with Cross-Validation: This identifies the most predictive feature subset. Pearson correlation analysis further refines the selection, retaining features with adjusted p-values < 0.05.
3. Data Balancing: To address class imbalance in the training set, minority classes (Spoofing and Data Alteration) are oversampled via random oversampling to match the majority class (Normal), resulting in a balanced training set of 34,272 samples.
4. Model Training & Baseline Comparison: A Gaussian noise injection (15% of original standard deviation) is applied to simulate real-world variability. The proposed optimized DT is trained and compared against baseline classifiers: Random Forest, K-Nearest Neighbors (KNN), Multi-Layer Perceptron (MLP), and CatBoost.
5. Explainability Integration: The framework incorporates two XAI methods:
   • SHAP (SHapley Additive exPlanations): Provides local and global feature attribution.
   • Morris Sensitivity Analysis: Identifies global feature importance by measuring the overall effect of input perturbations, including non-linear effects and interactions.

Key Contributions

• Optimized Decision Tree Framework: Development of a lightweight DT classifier specifically tuned for IoT environments, balancing high accuracy with low computational overhead.
• Comprehensive Preprocessing Pipeline: Implementation of a robust pipeline including noise reduction, normalization, and class imbalance handling tailored for IoT traffic.
• Dual-Mode Explainability: Integration of SHAP and Morris sensitivity analysis to provide both local (instance-level) and global (model-level) transparency, addressing the "black box" limitation of complex models.
• Edge-Ready Validation: Demonstration that the proposed model achieves state-of-the-art performance while maintaining inference speeds suitable for resource-constrained edge devices, unlike heavier ensemble or deep learning alternatives.

Results
The proposed framework was evaluated on a test set and via 5-fold cross-validation, yielding the following performance metrics:

• Accuracy: 99.91% on the test set; 98.93% mean cross-validation accuracy.
• F1-Score: 99.51%.
• Cohen's Kappa: 0.9960.
• Stability: The model demonstrated exceptional stability with a cross-validation standard deviation of only 0.0003, outperforming Random Forest, KNN, MLP, and CatBoost in consistency.
• Efficiency: The optimized DT exhibited minimal training and inference times compared to ensemble models, making it superior for real-time applications.

Feature Importance Insights
Both SHAP and Morris sensitivity analyses identified SrcMac (Source MAC address) as the most significant predictor across all classes. Other highly influential features included SIntPkt (Source Inter-packet time) and DIntPkt (Destination Inter-packet time). Conversely, features such as DstLoad, Rate, Load, and jitter were found to have negligible impact on predictions.

Significance and Claims
The paper claims that this framework successfully resolves the trade-off between detection quality, model interpretability, and computational efficiency. By achieving near-perfect accuracy (99.91%) while remaining computationally lightweight, the solution is positioned as a viable alternative to deep learning and blockchain-based methods that often suffer from high overhead and poor scalability. The integration of XAI ensures that the decision-making process is transparent, fostering trust and enabling adherence to AI transparency regulations. The authors conclude that this combination of high accuracy, explainability, and low resource consumption makes the framework a reliable tool for real-time anomaly detection in resource-constrained IoT environments. Future work is suggested to include adaptive learning processes and validation on broader, real-world datasets.